Dolibarr versions through 23.0.3 contain a flaw in the handling of the sqlfilters parameter used by several REST API list endpoints. The implementation only checks that parentheses are balanced and rewrites matched triplets, but it fails to sanitize or constrain additional input. As a result, an attacker who has gained authenticated access to the API can append malicious SQL fragments, such as UNION SELECT expressions, directly into the generated WHERE clause. This enables the attacker to retrieve arbitrary rows from any database table, including those holding password hashes and API keys. The vulnerability falls under CWE‑89 and is classified as a standard SQL injection that leads to unauthorized data disclosure.

The affected product is Dolibarr ERP/CRM, all releases up to and including version 23.0.3. The issue was fixed by commit 14db36e, and the vulnerability should be addressed by upgrading to a patched build or by applying the corresponding back‑port. Customer sites that cannot immediately update should be aware that any authenticated API user can exploit the flaw.

With a CVSS score of 7.2 the vulnerability poses high risk to confidentiality; however, it requires an existing authenticated API credential. Because EPSS data is not available and the error is not listed in CISA’s KEV catalog, the public exploitation probability is not precisely quantified, but the high severity and the ease of input manipulation imply that the risk is significant. Attackers could exfiltrate sensitive data by sending crafted requests to the affected endpoints. Therefore, users should consider the vulnerability high priority and act promptly.